A flaw was found in the kubevirt-csi component of OpenShift Virtualizations Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker nodes volume by creating a custom Persistent Volume that matches the name of a worker node.
The product mixes trusted and untrusted data in the same data structure or structured message.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Red Hat OpenShift Container Platform 4.13 | RedHat | openshift4/kubevirt-csi-driver-rhel8:v4.13.0-202404200313.p0.g9d909f7.assembly.stream.el8 | * |
| Red Hat OpenShift Container Platform 4.14 | RedHat | openshift4/kubevirt-csi-driver-rhel8:v4.14.0-202404161544.p0.g48fafc4.assembly.stream.el8 | * |
| Red Hat OpenShift Container Platform 4.15 | RedHat | openshift4/kubevirt-csi-driver-rhel8:v4.15.0-202403220332.p0.gd3bdbce.assembly.stream.el8 | * |